1708 matches found
Security: Invalid EJB caller role check implementation
It was found that the isCallerInRole method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles...
Ubuntu: Security Advisory (USN-2302-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 14.04 LTS : Tomcat vulnerabilities (USN-2302-1)
The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2302-1 advisory. David Jorm discovered that Tomcat incorrectly handled certain requests submitted using chunked transfer encoding. A remote attacker could use this flaw t...
USN-2302-1 tomcat6, tomcat7 vulnerabilities
David Jorm discovered that Tomcat incorrectly handled certain requests submitted using chunked transfer encoding. A remote attacker could use this flaw to cause the Tomcat server to consume resources, resulting in a denial of service. CVE-2014-0075 It was discovered that Tomcat did not properly...
CVE-2014-3326
SQL injection vulnerability in the web framework in Cisco Security Manager 4.5 and 4.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCup26957...
Sql injection
SQL injection vulnerability in the web framework in Cisco Security Manager 4.5 and 4.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCup26957...
CVE-2014-3326
SQL injection vulnerability in the web framework in Cisco Security Manager 4.5 and 4.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCup26957...
CVE-2014-3326
CVE-2014-3326 affects Cisco Security Manager 4.5 and 4.6. The issue is an SQL injection in the web framework caused by insufficient controls on SQL statements, allowing an authenticated remote attacker to execute arbitrary SQL commands via unspecified vectors. The vulnerability can lead to exposu...
PT-2014-5220
Name of the Vulnerable Software and Affected Versions Cisco Security Manager versions 4.5 through 4.6 Description A SQL injection issue in the web framework of Cisco Security Manager allows remote authenticated users to execute arbitrary SQL commands. Recommendations For Cisco Security Manager...
CVE-2014-3326: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the web framework in Cisco Security Manager 4.5 and 4.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCup26957...
Cisco Security Manager SQL Injection Vulnerability
A vulnerability in the web framework code of Cisco Security Manager could allow an authenticated, remote attacker to execute arbitrary queries on the database. The vulnerability is due to insufficient controls on Structured Query Language SQL statements. An attacker could exploit this vulnerabili...
FreeBSD : tomcat -- multiple vulnerabilities (81fc1076-1286-11e4-bebd-000c2980a9f3)
Tomcat Security Team reports : Tomcat does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference,...
CVE-2014-0602
Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460...
Directory traversal
Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460...
CVE-2014-0602
Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460...
CVE-2014-0602
CVE-2014-0602 is a directory traversal vulnerability in the DumpToFile method of the NQMcsVarSet ActiveX control in NetIQ Security Manager up to version 6.5.4, allowing remote attackers to realize arbitrary code execution via crafted paths. Related entries (CVE-2014-3460) describe the same access...
CVE-2014-0602: Improper Control of Generation of Code
Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460...
PT-2014-3701
Name of the Vulnerable Software and Affected Versions NetIQ Security Manager versions prior to 6.5.5 Description A directory traversal issue exists in the DumpToFile method of the NQMcsVarSet ActiveX control. This allows remote attackers to execute arbitrary code. Recommendations For versions pri...
McAfee Network Security Manager 5.1.7 Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/37004/info McAfee Network Security Manager is prone to an information-disclosure vulnerability because it fails to properly protect sensitive cookie data with the 'HTTPOnly' protection mechanism. A successful exploit may...
ManageEngine Security Manager Plus <= 5.5 build 5505 Path Traversal
No description provided by source. !/usr/bin/python +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Security Manager Plus = 5.5 build 5505 Path Traversal Win+Linux Date : 18-10-2012 Author : xistenc...